Privacy Policy

1. Who We Are

LeadWise B.V. is a private limited company incorporated under Dutch law (KVK: 91872324), with its principal place of business in Zeist, The Netherlands. We operate the LeadWise app for iOS and Android, the website www.leadwise.app, and the 360° feedback site feedback.leadwise.app.

LeadWise B.V. is the data controller for the personal data described in this policy. We have not appointed a Data Protection Officer, as we are not required to; all privacy questions can be sent to info@leadwise.app.

2. Data We Collect

2.1 If you have a LeadWise account

• Account details: your name and email address. If you sign up with email and password, your password is handled by Google Firebase Authentication and stored only in hashed form; we never see it. If you sign in with Apple or Google, we receive your name and email address from them (Apple may give us a private relay address instead of your real one). We also give your account a random account ID, which is how our systems and providers refer to you.
• Optional profile details: job title, company name and country, and your answers to the onboarding questions about your role and goals. At present these are only shown back to you in the app.
• Subscription status and purchase history: whether you have an active subscription or free trial, when that last changed, whether it is set to renew, and the record of your purchases and renewals kept by RevenueCat (see Section 6). Payment is handled by the Apple App Store or Google Play; we never receive your card or payment details.
• Consent record: the date and time you accepted our Terms and Privacy Policy, and which version you accepted.
• Learning activity: which weeks and content you have unlocked and completed, listening minutes, quiz results, your answers to exercises, badges and streaks, and any thumbs-up/down rating and comment you leave on content.
• Self-assessment: your answers to the 60-statement manager self-assessment and the scores calculated from them.
• 360° feedback: the first names and email addresses of the people you invite, and your feedback results. See Section 5.
• Conversations with Lisa: the messages you send and Lisa's replies. See Section 4.
• Support messages: if you use Contact Us in the app, your category, subject and message, together with your account email address and account ID, are emailed to our support mailbox.
• Notification data: a push notification token for your device, your device's time zone (so reminders arrive at a reasonable local time) and whether notifications are switched on. We also store the most recent weekly coaching nudge, so the app can show it to you.
• Email verification: the time you last requested a verification email.
• Technical data: when the app contacts our servers, our hosting provider records your IP address, the time, the request made and your account ID in server logs. The app also uses Google Firebase App Check, which asks Apple (App Attest) or Google (Play Integrity) to confirm that requests come from a genuine copy of the app.

2.2 If you are invited to give 360° feedback

• Invitation details: your first name, email address and role (manager or direct report), as entered by the LeadWise user who invited you, together with that user's name, the status of your invitation (waiting, answered, declined or replaced) and the dates it was created, sent, reminded and expires.
• Your answers: your ratings (1 to 5) on 60 statements. There are no free-text fields.
• In your browser: the feedback page keeps the code from your link for as long as the tab is open, and saves your progress in your browser's local storage so nothing is lost if you close the page. Both are removed when you submit or decline.
• Technical data: your IP address and the request made are recorded in server logs.

2.3 If you visit our website or contact us

• Website visits: Cloudflare, which hosts our website, processes your IP address and browser information to deliver pages and protect the site against attacks. We also use Cloudflare Web Analytics to count visits to www.leadwise.app. It records the page visited, the page that referred you, your country, your browser, operating system and device type, and page-loading times. According to Cloudflare, it uses no cookies or other storage in your browser and does not fingerprint visitors by IP address or browser details. It does not record query strings. We see totals only, not individual visitors.
• Waitlist: your name and email address.
• Organisation enquiries: your name, work email address, company, number of managers and message.
• Form protection: when you submit a form, Cloudflare Turnstile checks that you are not a bot, and we keep a short-lived counter linked to your IP address (for up to about 24 hours) to limit abuse.
• Email confirmation page: when you open an email verification link, the one-time code is sent to Google Firebase Authentication to confirm your address.
• Emails you send us and our replies.

2.4 What we do not collect

The app contains no analytics, crash-reporting or advertising software. We do not collect your advertising identifier, precise location, contacts, photos, or microphone or camera input, and we do not buy data about you from other companies.

3. How We Use Your Data and Our Legal Bases

• Providing the service you signed up for: your account, content and progress, the self-assessment, 360° feedback, Lisa, and support. Legal basis: performance of our contract with you.
• Personalising the app: showing your name in the app and using it in the 360° feedback invitations sent on your behalf. Legal basis: contract.
• Managing your subscription: confirming your subscription status with RevenueCat and the app stores. Legal basis: contract.
• Sending service emails: email verification, and 360° feedback invitations and reminders on your behalf. Legal basis: contract; for the people you invite, legitimate interests (see Section 5).
• Sending push notifications ("nudges"): reminders about new content and unfinished weeks, and a weekly coaching nudge, which is a short piece of guidance tied to that week's programme. The nudge is also shown inside the app as part of the service, whether or not notifications are switched on. Legal basis for push notifications: your consent, given through your device's notification permission. You can withdraw it at any time in the app or your device settings.
• Reviewing a sample of coaching conversations to improve Lisa. Legal basis: our legitimate interest in improving our Products (see Section 4).
• Keeping the service secure: App Check, rate limiting, bot protection and server logs, to prevent fraud and abuse and investigate problems. Legal basis: our legitimate interest in keeping LeadWise and its users safe.
• Understanding how our website is used: visit counts from Cloudflare Web Analytics. Legal basis: our legitimate interest in knowing which pages are useful.
• Recording your acceptance of our Terms. Legal basis: our legitimate interest in being able to show what you agreed to.
• Waitlist emails. Legal basis: your consent.
• Responding to organisation enquiries. Legal basis: steps taken at your request before entering into a contract, or our legitimate interest in responding to business enquiries.
• Meeting legal obligations, such as tax record-keeping and lawful requests from authorities. Legal basis: legal obligation.

Where we rely on legitimate interests, you can object at any time (see Section 10).

We do not use your data for advertising, we do not sell it, and we do not currently send marketing emails. If we ever want to, we will ask for your consent first. We do not make decisions about you that have legal or similarly significant effects based solely on automated processing: assessment scores and Lisa's replies are generated automatically, but only for your own development.

4. Lisa, the AI Coach

• Lisa is an artificial intelligence, not a human coach.
• When you send Lisa a message, our server sends it, together with the earlier messages in the same conversation (up to the last 50), to Google's Gemini API to generate a reply. We do not send your name, email address or other account details with it.
• Google processes these messages as our service provider under paid-service terms that do not allow it to use them to train its models. Google may keep them for a limited period to detect abuse.
• Your conversations are stored in our database so you can return to them. The app keeps your 20 most recent conversations and automatically deletes older ones, and you can delete any conversation yourself at any time.
• Please do not share sensitive information, such as health details, or information that identifies other people, such as team members' full names. Lisa does not need it to help you.

We may review a sample of coaching conversations, in full, to help us improve Lisa's coaching quality and our service. This review is carried out by our own team internally; conversations are not shared with any third party for this purpose. The conversations we review are not linked to your name, account, or any other identifying information we hold about you. However, if you share identifying details within the conversation itself — for example, your own name or details about a colleague — that information remains in the text as you wrote it. We do this on the basis of our legitimate interest in improving our Products, having weighed this against your privacy. There is currently no way to opt out of this review.

5. 360° Feedback

If you request feedback

• You enter the first name and email address of your manager and of 3 to 15 direct reports. Please only invite people you work with who would expect to hear from you about this, and let them know beforehand.
• We email each person an invitation on your behalf, containing your full name and a personal single-use link that is valid for 30 days. If they have not responded after 4 days, we send one automatic reminder.
• Your manager's response is shown to you individually, as their assessment of you. Your direct reports' responses are only ever shown to you combined, and only once at least three have responded and at least 7 days have passed since you started. You never see an individual direct report's answers, or which of them have answered. You do see if someone declined.

If you are invited to give feedback

• We use your name and email address only to send you the invitation, one reminder, and a new invitation if the person who invited you asks for it to be sent again, and to make sure each person responds only once. Legal basis: legitimate interests, namely the professional development of the person who invited you and our interest in providing this feature.
• Taking part is voluntary. You can ignore the email, or open the link and choose Decline. If you decline, the person who invited you sees that you declined, and we send you no further emails about that request.
• Your answers are stored in a separate record that contains only your role and your answers, with no name, email address, submission time or reference to your invitation. That record is deleted when the feedback request closes; only the scores calculated from the answers are kept. We do not try to identify individual respondents, and only a small number of authorised LeadWise administrators can access the database.
• If you were invited as the person's manager, your answers are shown to them individually, as explained on the feedback page. Your individual answers are deleted when the request closes; the scores calculated from them are kept.

6. Who We Share Data With

Service providers who process data on our behalf

These providers act only on our instructions, under data processing terms:

• Google Cloud and Firebase (Google): our database (Cloud Firestore), file storage, backend servers (Cloud Run), sign-in (Firebase Authentication), push notifications (Firebase Cloud Messaging), app integrity checks (App Check), server logs (Cloud Logging) and secure key storage. Our database, file storage and backend servers are located in the Netherlands (Google Cloud region europe-west4).
• Google Gemini API (Google): generating Lisa's replies (see Section 4).
• Google Workspace (Google): our email service, used to send verification, invitation and reminder emails and to receive support messages; and the spreadsheets that receive waitlist sign-ups and organisation enquiries from our website.
• RevenueCat (RevenueCat, Inc., USA): managing in-app subscriptions and confirming your subscription status. RevenueCat identifies you by a random account ID, not by your name or email address, and receives purchase and device information from the app stores and the app.
• Cloudflare (Cloudflare, Inc.): hosting www.leadwise.app and feedback.leadwise.app, visit statistics for our website (Cloudflare Web Analytics), handling website form submissions, and bot protection with Cloudflare Turnstile. For Turnstile, Cloudflare acts as our processor, and separately as an independent controller for the signals it uses to improve Turnstile's own bot detection. See Cloudflare's Turnstile Privacy Addendum at www.cloudflare.com/turnstile-privacy-policy.

Companies that handle data under their own privacy policies

• Apple and Google as app stores process your purchase and payment, and your subscription if you manage or cancel it with them.
• Apple and Google sign-in, if you choose Sign in with Apple or Google Sign-In, and the Apple App Attest and Google Play Integrity services used by App Check.

Other disclosures

• Legal requirements: we may disclose data where required by law, court order or a lawful request from an authority.
• Professional advisers, such as lawyers and accountants, under a duty of confidentiality.
• Business transfers: if LeadWise is involved in a merger or acquisition, your data may be transferred. We will tell you before it becomes subject to a different privacy policy.

7. Organisations and Employers

If an organisation has purchased LeadWise seats for its people, we provide that organisation with aggregated, anonymised reporting covering the seats it pays for — general usage and engagement information about the group as a whole. No organisation receives individual-level visibility of any kind: nobody at your organisation can see your personal activity, your progress, your exercise answers, your self-assessment answers or results, your 360° feedback results, or your conversations with Lisa.

If you use LeadWise through an organisation, these commitments apply now and in future:

• Your individual results stay private. Your self-assessment, 360° feedback results, progress, exercises, badges and conversations with Lisa are never shared with or made visible to your employer, your manager or anyone else in your organisation.
• Organisational reporting is aggregated and anonymised across enough users that it cannot be traced back to any individual. It is not a lower-detail view of individual results, and it never includes anything that identifies you or singles you out.

8. International Transfers

Our main database, file storage and backend servers are in the European Union (the Netherlands). Some of our providers process data outside the European Economic Area, including in the United States:

• Google, for Firebase Authentication, Firebase Cloud Messaging, App Check, the Gemini API and Google Workspace;
• RevenueCat, in the United States;
• Cloudflare, whose global network usually handles your request at the data centre nearest to you.

Where data is transferred outside the EEA, we rely on the recipient's certification under the EU–U.S. Data Privacy Framework (and its UK and Swiss extensions) where available, and otherwise on Standard Contractual Clauses approved by the European Commission, together with measures such as encryption in transit.

You can request a copy of the relevant safeguards by contacting us at info@leadwise.app.

9. How Long We Keep Data

• Your account and everything in it (account and profile details, subscription status, consent record, learning activity, self-assessment, 360° feedback results, content ratings and conversations with Lisa): kept for as long as your account exists, and deleted from our live systems immediately when you delete your account in the app (Profile → Settings → Account Actions → Delete Account). Ending a subscription does not delete your account, so your progress is still there if you return. If an account has had no active subscription and no sign-in for 3 years, we will delete it.
• Conversations with Lisa: the app keeps your 20 most recent conversations and deletes older ones automatically; you can delete any conversation at any time.
• 360° feedback invitations and answers: when a feedback request closes, either when the combined results are revealed or when it ends without enough responses, and no later than 38 days after it started, the individual answers are deleted and the names and email addresses of the people invited are removed from the invitations. The scores, and the rest of each invitation (role, status and dates), are kept for as long as the inviting user's account exists and deleted with it. An invited person can ask us to delete their invitation at any time.
• Support messages and emails we have sent you: kept in our mailbox for up to 2 years after our last contact with you.
• Server logs: kept for about 90 days.
• Backups: deleted data remains in our database backups for a limited time: up to 7 days in point-in-time recovery and up to 8 weeks in weekly backups. Backups are used only to restore the service after a failure.
• Website visit statistics: Cloudflare keeps detailed records for 7 days and summarised statistics for up to six months.
• Website form protection counters: deleted automatically after about 24 hours.
• Waitlist sign-ups: kept until 12 months after the app launches, or until you ask us to remove you, whichever is sooner.
• Organisation enquiries: kept for up to 2 years after our last contact, unless the enquiry leads to a customer relationship.
• Subscription records held by RevenueCat: your purchase history in RevenueCat is linked only to a random account ID, not to your name or email address, and is not automatically deleted when you delete your LeadWise account. You can ask us to delete it.
• Financial records: for Dutch tax purposes we keep business-level financial records, such as app store payout reports, for 7 years. These are not linked to your individual account.
• On your device: downloaded audio, cached content and unfinished self-assessment answers are removed from the device when you delete your account in the app, or when you uninstall it. On the 360° feedback site, saved progress is removed from your browser when you submit or decline.

10. Your Rights

Wherever you live, you can ask us to:

• access the personal data we hold about you and receive a copy;
• correct inaccurate data (you can edit your profile directly in the app);
• delete your data (you can delete your account directly in the app);
• restrict how we use your data;
• port your data, receiving it in a structured, machine-readable format;
• object to processing based on our legitimate interests;
• withdraw consent at any time, for example by switching off notifications or leaving the waitlist, without affecting processing that has already taken place.

These rights also apply to people invited to give 360° feedback. To exercise any of them, email info@leadwise.app. It is free. We will respond within one month; if a request is complex we may extend this by up to two further months, and we will tell you if we do. We may need to confirm your identity, for example by asking you to write from the email address on your account.

11. Security

Data is encrypted in transit between the app, our websites and our servers, and encrypted at rest by our hosting provider. Database access rules ensure that, from the app, only you can read your own data. Audio is delivered through short-lived private links. Credentials are held in a dedicated secrets store, and administrative access is limited to a small number of authorised people. No system is completely secure, but if a breach affects your personal data we will notify you and the authorities as the law requires.

12. Cookies, Tracking and Device Storage

• Our website does not use cookies and does not track you across sites. It counts visits with Cloudflare Web Analytics, which uses no cookies or browser storage (see Section 2.3). The only browser storage used is a temporary flag remembering whether you closed the exit pop-up during your visit; it never leaves your browser and is cleared when you close the tab. Pages with forms load Cloudflare Turnstile (see Section 6).
• The 360° feedback site does not use cookies or analytics. It keeps the code from your link for as long as the tab is open, and saves your answers in progress in your browser until you submit or decline.
• The app contains no analytics, crash-reporting or advertising software and does not track you across other companies' apps or websites. On your device it stores your sign-in session, cached content and audio, and unfinished self-assessment answers.

13. Children

LeadWise is intended for adults in professional roles, and you must be at least 18 years old to use it (see our Terms). We do not knowingly collect personal data from anyone under 18. If you believe we have, please contact us at info@leadwise.app and we will delete it promptly.

14. Complaints

If you have a concern about how we handle your personal data, please contact us first at info@leadwise.app and we will do our best to resolve it.

You also have the right to lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens (www.autoriteitpersoonsgegevens.nl), or with the supervisory authority where you live or work.

15. Do-Not-Track and Global Privacy Control

We do not track you across websites, sell your data or use it for targeted advertising, so there is no such activity for a Do-Not-Track or Global Privacy Control (GPC) signal to switch off. Where the law recognises GPC as a request to opt out, we treat it as one.

16. US Residents

This section applies to residents of California and of other US states with comprehensive privacy laws (such as Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia), to the extent those laws apply to us.

What we collect and why

In the past 12 months we have collected the following categories of personal information, from the sources and for the purposes described in Sections 2 and 3, and disclosed them for business purposes only to the service providers in Section 6:

• Identifiers: name, email address, account ID, IP address, push notification token.
• Commercial information: subscription status and purchase history.
• Internet or other electronic network activity: server logs, in-app learning activity, and website visit statistics that are not linked to you.
• Professional or employment-related information: optional job title, company and role, self-assessment answers, and 360° feedback.
• Inferences: self-assessment and 360° feedback scores describing leadership behaviours.
• Sensitive personal information: account login credentials, used only to provide and secure your account.

We keep each category for the periods in Section 9.

What we do not do

We do not sell or "share" personal information (for cross-context behavioural advertising), use it for targeted advertising, or use it for profiling that produces legal or similarly significant effects, and we have not done so in the past 12 months. We do not use sensitive personal information to infer characteristics about you.

Your rights

Depending on your state, you have the right to know about and access the personal information we hold, to correct it, to delete it, to receive a portable copy, to opt out of sale, sharing, targeted advertising and profiling (none of which we do), and to limit the use of sensitive personal information. We will not discriminate against you for exercising these rights.

To make a request, email info@leadwise.app. An authorised agent may make a request for you with your signed permission. We will verify requests by matching them to the email address on your account, and respond within 45 days, extendable by a further 45 days where permitted.

Appeals

If we decline your request, you can appeal by replying with "Appeal" in the subject line. We will respond within the time required by your state's law, and no later than 60 days. If you are not satisfied with the outcome, you may contact your state Attorney General.

17. Other Regions

The rights in Section 10 are available to everyone. In addition:

• United Kingdom: we process personal data in accordance with the UK GDPR. You can complain to the Information Commissioner's Office (ico.org.uk).
• Switzerland: we process personal data in accordance with the Federal Act on Data Protection. You can complain to the Federal Data Protection and Information Commissioner.
• Brazil: you have the rights set out in the LGPD, including confirmation of processing, access, correction, anonymisation or deletion, portability, information about who we share data with, and withdrawal of consent. You can complain to the ANPD.
• Canada: we process personal data in accordance with PIPEDA and applicable provincial laws, including Quebec's. The person responsible for privacy can be reached at info@leadwise.app. You can complain to the Office of the Privacy Commissioner of Canada.
• Australia and New Zealand: we process personal data in accordance with Australia's Privacy Act 1988 and New Zealand's Privacy Act 2020. The overseas recipients of your data are the providers in Section 6, located in the countries listed in Section 8. You can complain to the Office of the Australian Information Commissioner or New Zealand's Privacy Commissioner.
• South Africa: we process personal data in accordance with POPIA. Our Information Officer can be reached at info@leadwise.app. You can complain to the Information Regulator.
• India: you have the rights set out in the Digital Personal Data Protection Act, 2023. Grievances can be sent to info@leadwise.app, and you may approach the Data Protection Board of India.
• Elsewhere: if you have additional rights under your local law, you can exercise them by emailing us.

18. Changes to This Policy

We may update this policy from time to time. The updated version will be posted here and in the app with a new date at the top. If we make material changes, we will tell you in the app or by email before they take effect, and where the law requires it we will ask for your consent again.

19. How to Contact Us

For questions, concerns or requests about this policy or your personal data:

• Email: info@leadwise.app
• Company: LeadWise B.V. (KVK: 91872324)
• Address: Zeist, The Netherlands